OpenAI Launches Dots, Its Always-On AI Agents: What Businesses Need to Know
OpenAI has launched Dots, a new class of persistent AI agents designed to keep working between conversations. Announced at the company’s developer conference on Sep 29, 2026, Dots are powered by GPT-6 Astra, use their own cloud computer and can work across apps a user chooses to connect.
That makes a Dot meaningfully different from a chatbot session. A user can give it an ongoing responsibility, define what it may do without asking and receive updates while it works. OpenAI says a Dot can research in the background, use scheduled tasks, remember context from connected apps and return to the user for decisions that require judgment.
The launch moves agentic AI closer to a continuing operational role. When software can act repeatedly across email, messaging, files and websites, teams must manage its authority—not just its answers.
Key takeaways
- Dots are persistent agents in ChatGPT, not a new standalone model.
- They use GPT-6 Astra, a cloud computer and connected apps to continue work between conversations.
- OpenAI is rolling Dots out to eligible Pro and Business Premium users; Enterprise, Edu and Healthcare access depends on an administrator-enabled beta.
- Local-computer access is optional and off by default, but connected-app information can be reviewed proactively and retained as memory.
- Safety evaluations are encouraging under their test conditions, yet OpenAI’s own results show that maintaining boundaries becomes harder across longer chains of tasks.
What OpenAI announced
OpenAI describes a Dot as an “always-on agent” inside ChatGPT. The official help page says it can take ongoing responsibility, make progress between conversations and use context to decide what step should happen next. It has a cloud computer, can access a browser and can interact with supported apps after a user grants access.
Independent reporting from Reuters, The Associated Press and The Verge confirms the core launch. The Verge reported support for more than 4,000 apps and connections to Slack and Microsoft Teams. AP described Dots as agents intended to complete ongoing tasks proactively. Reuters reported that OpenAI is positioning Dots for enterprise use and that sensitive actions require explicit consent.
OpenAI is gradually rolling out the product. Its help documentation says eligible ChatGPT Pro and Business Premium subscribers receive a first Dot, while Enterprise users—including Edu and Healthcare workspaces—can try a beta if a workspace administrator enables it. Creation currently starts on desktop web or the desktop app; mobile can be used to interact with a Dot when access is available, but not to create one.
This is a launch, not evidence that every workflow is production-ready. Availability varies by plan, market, administrator settings and connected app.
How a Dot differs from an ordinary chat
The clearest difference is persistence. A normal chat generally waits for the next message. A Dot can continue an assigned responsibility, run scheduled work and send progress updates without requiring a new prompt for each step.
| Capability | Ordinary chat | Dot |
|---|---|---|
| Work pattern | Turn-by-turn assistance | Ongoing responsibility and scheduled work |
| Compute surface | Chat tools available in the session | Dedicated cloud computer plus connected apps |
| Context | Conversation and enabled memory | Conversation, Dot memories and connected-app context |
| Authority | Usually asks before each external action | Can follow custom rules for independent, pre-approved, approval-required or handed-off actions |
| Oversight | User reviews each response | User also reviews activity, schedules, permissions and completed actions |
This shift matters more than a benchmark score. Drafting creates a reviewable artifact; permission to send, update or publish creates real-world consequences. Teams need narrow operating boundaries before measuring productivity gains.
Confirmed capabilities and launch limits
OpenAI’s documentation confirms several capabilities. A Dot can use a cloud computer; connect to apps; review connected information proactively; form memories; work with Slack; use a connected personal email account for tasks; create cloud tasks in preconfigured Codex environments; and run reminders or recurring checks.
Local-computer access is separate. It starts turned off and must be explicitly enabled through the desktop app. If enabled, a Dot may work with local files, skills and a local browser. Revoking that access stops future local work, but disconnecting an app does not automatically erase information already obtained from it. OpenAI says deleting the Dot is required to remove its own saved memories.
The launch also has practical limits:
- Users cannot currently create a Dot on mobile web.
- A Dot cannot initiate a voice call at launch.
- Personal-email access does not give the Dot its own independent email address.
- Text messaging is a limited US beta for some Pro users and uses a third-party provider.
- Only one Dot can be created initially, although OpenAI says multiple agents are planned.
- A user must still verify important work because OpenAI explicitly warns that Dots can make mistakes, even when following custom rules.
The product’s value will depend on integration quality, not the headline app count. Read-only access is very different from permission to send, delete, publish or spend.
What the safety evidence does and does not show
OpenAI published a Dots appendix in the GPT-6 Astra system card. Its prompt-injection test exposed Dots to 50,000 simulated emails, including 16,600 attack emails, across 100 bulk-attack runs. OpenAI reported no scored attack success in those runs. A separate iterative test recorded no scored success across 2,638 valid attempts in 100 attack chains.
Those results are useful, but they are not a guarantee. They are company-run evaluations with defined attack methods, synthetic environments and a particular production safeguard configuration. OpenAI also says manual red-teaming found opportunities to strengthen confirmation behavior and that it continues to address known vulnerabilities.
The most informative result may concern changing permissions. In one evaluation, Dots passed 45 of 49 episodes in which task scope or permissions changed during execution, including all 17 explicit permission changes. In a second test, the model showed no severe breach or exfiltration, but moderate scope-violation flags increased from 8.6% to 19.7% when the number of intervening tasks doubled from five to ten.
The reasonable interpretation is neither “unsafe” nor “proven safe.” Persistent systems face a compounding context problem: longer chains make it easier to mix instructions, carry information across tasks or act under an outdated assumption. That supports short scopes, checkpoints and conservative permissions.
A five-gate adoption framework
Before a business gives a Dot access to production systems, it should pass five gates. Failure at any gate means the task stays advisory or runs in a sandbox.
Scope
Define one outcome, one owner and a short time horizon. “Prepare a weekly support summary from these two sources” is testable. “Run customer success” is not. State what the agent must not do, especially sending, deleting, publishing, changing access or making commitments.
Data
List every connected source and classify the information it contains. Start with data that is non-sensitive, reversible and already authorized for the human owner. Keep credentials, regulated records, privileged legal material and broad shared drives outside the pilot unless a formal security review approves them.
Authority
Map each action to one of four controls: act without asking, act only when pre-approved in the task, ask before acting or hand the step to a human. Use the first category sparingly. A good pilot lets the agent read and draft, but requires approval to send, publish, delete, purchase or change permissions.
Review
Set a checkpoint and evidence requirement. The Dot should report what it used, what it changed, what remains uncertain and what needs approval. For high-impact work, review source records rather than only the summary. Sample routine work instead of assuming that past accuracy predicts the next task.
Exit
Decide how to pause, revoke access and remove retained context before the pilot starts. Record the owner for connected apps and scheduled tasks. Test the offboarding procedure once; an emergency control that no one has rehearsed is only a theory.
| Gate | Pass condition | Red flag |
|---|---|---|
| Scope | Narrow result with a named owner | Open-ended mandate across teams |
| Data | Minimum authorized sources | Broad access “in case it helps” |
| Authority | Consequential actions require approval | Agent can send, delete or buy by default |
| Review | Evidence and checkpoints are defined | Success judged only by polished output |
| Exit | Pause, revoke and memory plan tested | No one owns shutdown or cleanup |
What teams should test first
The safest early tasks are valuable but reversible: monitoring a public issue tracker, drafting a digest from approved sources or assembling a status report from a defined project folder.
Run the first pilot with synthetic or low-sensitivity data. Record the request, connected systems, approvals, actions and result. Deliberately test a conflicting instruction, a mid-task permission change and an ambiguous request that should trigger a question.
Measure time saved after review, correction rate, unnecessary escalations and boundary failures. An agent that needs extensive cleanup or acts beyond scope has not improved the workflow.
Frequently asked questions
What is OpenAI Dots?
Dots are persistent AI agents inside ChatGPT. They use GPT-6 Astra, a cloud computer and connected apps to work on ongoing tasks, run scheduled checks and return results or questions to a user.
Can a Dot use my computer?
Yes, but local access is optional and starts disabled. A user must connect and authorize a computer through the desktop app. Teams should grant the minimum access required and test revocation before production use.
Does disconnecting an app delete everything a Dot learned from it?
Not necessarily. OpenAI says disconnecting stops the connection but does not delete information the Dot already obtained. Deleting the Dot is the documented way to remove its saved conversations, memories and scheduled tasks.
Are Dots safe from prompt injection?
OpenAI reported no scored successes in two published automated tests, but those results apply to the tested conditions. The system card also describes ongoing weaknesses and greater difficulty maintaining boundaries across longer task chains. Treat prompt injection as a managed risk, not a solved problem.
The bottom line
Dots make the transition from conversational AI to persistent work visible. The opportunity is real: an agent that carries context, checks progress and coordinates across tools could remove repetitive handoffs. The risk is equally concrete because persistence expands the time, data and authority exposed to error.
The sensible response is a gated pilot. Give the agent a narrow job, limited data, conservative permissions, visible checkpoints and a tested exit. If it performs well under those constraints, expand one dimension at a time.
Key-takeaway box
Use a Dot as a junior operator with defined permissions, not as an invisible owner. Start with read-and-draft work, require approval for consequential actions and shorten task chains until the agent demonstrates reliable boundary control in your environment.
